Close unused ports on hp-ux

[uxuser]

dear colleagues...my ux server has the following ports open:
smtp-25
tftp - 69
unknown - 49153
cbt - 7777
pharos - 4443
personal-agent (5555)

kindly advice how to close it. your kind help will be highly appreciated.

best regards n thanks in advance

[Horia Chirculescu]

Hello,

>kindly advice how to close it.

Are you trying to kill the daemons that keep open those ports/services running or you are asking for a way to restrict access to those?

If you are looking for a way to stop the corresponding daemons, then you should find how those daemons are started.

Some are started from inetd so you must re-configure inted (see /etc/inetd.conf) in order to not re-start those services.

Horia.

[Johnson Punniyalingam · Accepted solution]

smtp-25
tftp - 69

As per above ports you can close it, by editing

and comment (#) under the /etc/inetd.conf
# inetd -c -> to reread the inetd configuration files

unknown - 49153
cbt - 7777
pharos - 4443
personal-agent (5555)

As per above (Application / 3rd party vendor ports)

you can edit the /etc/service

vi /etc/services

# unknown 49153
# cbt 7777
# pharos 4443
# personal-agent 5555 -> Its HP Data protector

HTH,
Johnson

[uxuser]

I want to close all these ports so that it doesnt run at any point in time until i open them again.

just block these from access

[Horia Chirculescu]

@Johnson

>As per above (Application / 3rd party vendor ports)

>you can edit the /etc/service

>vi /etc/services

Editing /etc/services does not stop the daemons that opens the corresponding port no. from that server.

The /etc/services file only convert service names to these ports.

In order to close the corresponding ports, the daemons must be stopped or firewalled as I said on my previous post.

Horia.

[Steven Schweda]

> vi /etc/services

Almost always a bad idea.

[Steven E. Protter]

Shalom,

These ports show open because there is a daemon(service) listening on that port.

25 is smtp sendmail. Shutdown the sendmail daemon, problem solved. A periodic cron job running sendmail -q (queuerunner) will get the external mail delivered.

tftp, trivial file transfer protocol. This can be commented out in /etc/inetd.conf and restarting internet services.

The rest however are applications that are installed on your system. Take a look at /etc/services and netstat -an | more

You will need to identify and shut down the applications listening on these ports to "close" them.

HP-UX does not ship with a running firewall active like Linux wants to. However using ipfilter to block these ports will more than likely disable user applications and some thought needs to go into this.

SEP

[Jean-Philippe Henry]

Hello,

To discover which process listens to a particular port, you might use the command lsof -i TCP:. The PID of the searched process is then displayed.

For instance :

lsof -i TCP:25
COMMAND PID USER FD TYPE DEVICE SIZE/OFF NODE NAME
sendmail 1054 root 6u IPv4 0x3100d48af58 0t0 TCP *:smtp (LISTEN)
sendmail 1054 root 7u IPv6 0x30013f32360 0t0 TCP *:smtp (LISTEN)

It shows that port 25 is listened by a process whose PID is 1054 and whose name is sendmail.

This way you will be able to find out the PID of the process that listen to port 49153, to terminate it with the command kill.

If you have no lsof installed, you might download it from http://hpux.connect.org.uk/hppd/hpux/Sysadmin/lsof-4.82/

Cheers,

Jean-Philippe